Researchers scanning internet-facing server management interfaces found 36,872 exposed Baseboard Management Controllers running IPMI. Of those, 24,650 disclose password-derived authentication hashes before login — a flaw rooted in the IPMI 2.0 specification that has been present for approximately two decades. Any attacker who can reach one of these interfaces obtains the hash without supplying any credentials, then can attempt to crack it offline to recover the underlying password and take full control of the server. Security researchers report that attackers have begun scanning for vulnerable BMCs.
The IPMI 2.0 Hash Disclosure Flaw: Pre-Authentication Exposure
IPMI 2.0’s authentication handshake was designed around a challenge-response mechanism. However, the specification requires the server to transmit a hash derived from the user’s password as part of the handshake — before any credential validation occurs. This means a client connecting to an IPMI 2.0 interface can obtain the password hash simply by initiating the handshake process, without ever presenting a valid username or credential.
The hash uses a weak derivation mechanism susceptible to offline brute-force and dictionary attacks. An attacker who captures the hash does not need to break it in real time against the server — they can take it offline and work through password candidates at their own pace using commodity computing hardware or cloud resources. Common and moderately complex passwords can be recovered in hours to days through this method.
36,872 Exposed Interfaces and the 24,650 That Leak Hashes
Of the 36,872 BMC management interfaces researchers identified as internet-facing, 24,650 — roughly two-thirds — actively disclose password hashes via the pre-authentication handshake flaw. The remaining third may run different IPMI versions, have modified configurations, or be protected by access controls that prevent the handshake from completing. The 24,650 that do disclose hashes represent servers where a remote attacker faces no technical barrier to obtaining the hash beyond initiating a connection.
The distribution is consistent with the prevalence of IPMI 2.0 in enterprise server hardware. BMCs are built into motherboards of server-class systems from major vendors and typically run firmware that implements IPMI 2.0 by default for compatibility with datacenter management tooling. The standard has been in place long enough that a large portion of the global server install base uses it, and its presence on internet-facing interfaces reflects a misconfiguration rather than an absence of alternatives.
What Full BMC Compromise Provides an Attacker
A Baseboard Management Controller provides out-of-band server management — capabilities that operate independently of the server’s operating system. These include remote power control (on, off, cycle), access to a virtual console that predates OS boot, the ability to mount virtual media for OS reinstallation, and hardware-level configuration changes. A BMC compromise gives an attacker physical-equivalent access to the server without physical presence.
Persistent Firmware Backdoors That Survive OS Reinstallation
The most severe consequence of BMC-level access is the ability to install persistent firmware-level backdoors. Because BMC firmware is stored independently of the server’s operating system, a backdoor written to BMC flash memory survives a full OS reinstallation — an operation that security teams often treat as a complete remediation for compromised servers. An attacker with BMC access can also use the remote power control and virtual media capabilities to reinstall the operating system to their own specifications, ensuring persistent access from the moment the new OS boots.
This persistence characteristic makes BMC compromise qualitatively different from a standard operating system breach. Standard incident response — reimaging the OS, rotating credentials, restoring from backup — does not evict a BMC-level attacker. Detection requires BMC firmware integrity verification, which few organizations perform routinely.
The Twenty-Year-Old Specification and the Current Threat Landscape
The IPMI 2.0 specification’s hash disclosure mechanism was not a novel discovery when it was first documented by security researchers in the early 2010s. The vulnerability has been publicly known for well over a decade. Its continued presence across 24,650 internet-exposed management interfaces reflects a persistent gap between known exposure and operational remediation in datacenter environments.
Security researchers report that attackers have taken note of the current scan results and have begun actively scanning for vulnerable BMCs — a pattern consistent with how disclosures of aggregate exposure data translate into attacker activity. The combination of public scanner results, the pre-authentication nature of the hash exposure, and the high value of BMC-level access makes this exposure a realistic near-term exploitation target.
Organizations should audit server inventory to identify any BMC management interfaces accessible from the internet, move those interfaces behind dedicated management networks or VPN-only access, and use strong, unique passwords for IPMI accounts on any BMC that requires remote access. The hash disclosure flaw is a protocol-level issue rather than a software vulnerability — no firmware patch eliminates it. Network access restriction is the primary effective control.
